From a576c938a1bc721909da96b22baea4d32bd9ba56 Mon Sep 17 00:00:00 2001 From: Joseph Yaksich Date: Wed, 5 Aug 2026 00:38:24 +0000 Subject: [PATCH] fix(phase4): read the root-owned OCI image store with sudo in Linux acceptance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The retained channel-image verification checked /var/lib/1helm-oci-v1/shared-images/sha256/ without sudo, but install-oci-runtime.sh creates that store root-owned and mode 0700. The ordinary runner user cannot traverse it, so the `[[ -d ... && sha256 ... ]]` assertion always failed after an otherwise successful clean install — the exact silent failure the new ERR trap pinpointed at this line. The adjacent state checks already use sudo; this one was the outlier. Run the directory test and the image digest read under sudo, matching the store's ownership. No product change; acceptance-script only. Co-Authored-By: Claude --- ops/platform-acceptance/linux.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/ops/platform-acceptance/linux.sh b/ops/platform-acceptance/linux.sh index d53579b..0138c3a 100755 --- a/ops/platform-acceptance/linux.sh +++ b/ops/platform-acceptance/linux.sh @@ -72,7 +72,8 @@ sudo systemctl is-active --quiet 1helm.service curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/clean-health.json" [[ "$(readlink -f /opt/1helm/current)" == "/opt/1helm/releases/$VERSION-$OFFLINE_DIGEST" ]] RETAINED_IMAGE="/var/lib/1helm-oci-v1/shared-images/sha256/$IMAGE_DIGEST" -[[ -d "$RETAINED_IMAGE" && "$(find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]] +sudo test -d "$RETAINED_IMAGE" +[[ "$(sudo find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]] # Resolve the newest immutable public Stable release distinct from this # candidate version. Candidate versions normally remain unchanged during @@ -140,7 +141,8 @@ sudo systemctl is-active --quiet 1helm.service curl -fsS http://127.0.0.1:8123/api/setup/status >"$work/rollback-health.json" STATE_AFTER="$(sudo sha256sum "$MARKER" | awk '{print $1}')" [[ "$STATE_BEFORE" == "$STATE_AFTER" ]] -[[ -d "$RETAINED_IMAGE" && "$(find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]] +sudo test -d "$RETAINED_IMAGE" +[[ "$(sudo find "$RETAINED_IMAGE" -maxdepth 1 -type f -name '*.oci.tar' -exec sha256sum {} \; | awk '{print $1}')" == "$IMAGE_DIGEST" ]] sudo rm -rf -- "$FAILURE_RELEASE" export HELM_PREVIOUS_VERSION="$PREVIOUS_VERSION"